1

Problem: Around 1% of the requests are "SSL handshake failure". They are not coming from any specific source.

Pattern: I usually see the problem when a client make too many requests quickly. Although, sometimes there are single requests failing SSL handshake.

Question: I would like to know if there's something wrong with my configuration, or 1% failure rate is expected/normal, or something wrong on client side, maybe they are using wrong TLS version etc. I know 1% sounds small, but 1% is over 20.000.000 hits a day with our current traffic.

Setup:

OS: Debian 9
HA-Proxy version: 1.8.19-1~bpo9+1 2019/02/12

SSL served by haproxy, two backends do data processing. They are not webservers.

Important parts from config:

global

        nbproc 1
        nbthread 40
        cpu-map auto:1/all 0-
        maxconn 400000
...

defaults
defaults
        log     global
        mode    http
        option  dontlognull
        option redispatch
        option forceclose
        option forwardfor
        retries 5
        timeout connect 100
        timeout queue 5000
        timeout client  100000
        timeout server  100000
        maxconn 25000

        ssl-default-bind-options no-sslv3
        ssl-default-bind-ciphers ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS

        tune.ssl.default-dh-param 2048


...

listen app1-https
        option httplog
        bind xx.xx.xx.1:443 ssl crt /path/to/ssl/certname.pem

listen app2-https
        option httplog
        bind xx.xx.xx.2:443 ssl crt /path/to/ssl/certname.pem
...

Logs (grep -i handshake)

Apr  1 09:18:54 loadbalancer haproxy[14141]: 115.132.xx.xx:9225 [01/Apr/2019:09:18:54.373] app1-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 102.250.xx.xx:50122 [01/Apr/2019:09:18:39.314] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 180.102.xx.xx:31197 [01/Apr/2019:09:18:54.134] app1-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.14.xx.xx:34075 [01/Apr/2019:09:18:54.446] app1-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 172.58.xx.xx:44834 [01/Apr/2019:09:18:43.858] app1-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 115.164.xx.xx:31818 [01/Apr/2019:09:18:40.680] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 41.190.xx.xx:15014 [01/Apr/2019:09:18:54.809] app1-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.35.xx.xx:62348 [01/Apr/2019:09:18:50.541] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.35.xx.xx:62353 [01/Apr/2019:09:18:50.541] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.35.xx.xx:62352 [01/Apr/2019:09:18:50.541] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.35.xx.xx:62337 [01/Apr/2019:09:18:50.518] app2-https/1: SSL handshake failure
Apr  1 09:18:54 loadbalancer haproxy[14141]: 49.35.xx.xx:62351 [01/Apr/2019:09:18:50.543] app2-https/1: SSL handshake failure
Improve this question
5
  • 1
    Please clarify: Do you believe there is any handshake failure in the log that could be attributed to a typical user of your site, or are you just wondering about bots connecting to your load balancer?
    – anx
    Apr 1, 2019 at 11:29
  • Same failure happens for all users. When I check a specific IP address, I can see some of the requests are success but some failing with "SSL handshake failure". I'm trying to figure out why some some of the requests are failing. I don't think any of these are bots or malicious.
    – Omur O.
    Apr 1, 2019 at 12:47
  • grep for the intersection of failing and succeeding IPs in some application log, extract user agent or query string prefix and you will likely reveal a much more interesting correlation than "many requests in short time".
    – anx
    Apr 1, 2019 at 13:30
  • Are you using ssl termination? if yes please try to increase default-dh-param value.
    – asktyagi
    May 1, 2019 at 5:56
  • Yes I use ssl termination and I have tune.ssl.default-dh-param 2048 in the config.
    – Omur O.
    May 2, 2019 at 12:44

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .